prep for real deploy

Author: isTravis

.github/workflows/deploy.yml

@@ -1,13 +1,31 @@
 name: Deploy
 
+run-name: >-
+  ${{
+    github.event_name == 'release' && format('Deploy prod: {0}', github.event.release.tag_name) ||
+    format('Deploy dev: {0}', github.sha)
+  }}
+
 concurrency:
-  group: deploy-${{ github.ref }}
+  group: >-
+    deploy-${{
+      github.event_name == 'release' && format('prod-{0}', github.event.release.tag_name) ||
+      format('dev-{0}', github.ref)
+    }}
   cancel-in-progress: true
 
 on:
   push:
-    branches: [ main ]
+    branches: [main]
+  release:
+    types: [published]
   workflow_dispatch:
+    inputs:
+      no_cache:
+        description: Build without Docker cache
+        required: false
+        default: false
+        type: boolean
 
 env:
   REGISTRY: ghcr.io
@@ -18,45 +36,61 @@ permissions:
   packages: write
 
 jobs:
-  build:
-    name: Build & Push Image
+  deploy:
+    name: Deploy
     runs-on: ubuntu-latest
-    outputs:
-      image_tag: ${{ steps.meta.outputs.version }}
+
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set deployment vars
+        id: vars
+        run: |
+          if [[ "${{ github.event_name }}" == "release" ]]; then
+            echo "image_tag=${{ github.event.release.tag_name }}" >> $GITHUB_OUTPUT
+            echo "host=${{ secrets.SSH_HOST_PROD }}" >> $GITHUB_OUTPUT
+            echo "env_file=.env.enc" >> $GITHUB_OUTPUT
+            echo "stack_name=underlay" >> $GITHUB_OUTPUT
+          else
+            echo "image_tag=${{ github.sha }}" >> $GITHUB_OUTPUT
+            echo "host=${{ secrets.SSH_HOST_DEV }}" >> $GITHUB_OUTPUT
+            echo "env_file=.env.dev.enc" >> $GITHUB_OUTPUT
+            echo "stack_name=underlay-dev" >> $GITHUB_OUTPUT
+          fi
 
-      - uses: docker/setup-buildx-action@v3
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
 
-      - uses: docker/login-action@v3
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - id: meta
+      - name: Extract metadata
+        id: meta
         uses: docker/metadata-action@v5
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
-          tags: |
-            type=sha,prefix=
-            type=raw,value=latest,enable={{is_default_branch}}
 
-      - uses: docker/build-push-action@v5
+      - name: Build and push
+        uses: docker/build-push-action@v6
         with:
           context: .
           target: production
           push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
+          provenance: false
+          sbom: false
+          no-cache: ${{ inputs.no_cache || false }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
+          tags: |
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.vars.outputs.image_tag }}
+            ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
 
-  deploy:
-    name: Deploy
-    needs: build
-    runs-on: ubuntu-latest
-    steps:
       - name: Start SSH agent
         uses: webfactory/ssh-agent@v0.9.0
         with:
@@ -65,34 +99,34 @@ jobs:
       - name: Add known hosts
         run: |
           mkdir -p ~/.ssh
-          ssh-keyscan -H "${{ secrets.SSH_HOST }}" >> ~/.ssh/known_hosts
+          ssh-keyscan -H "${{ steps.vars.outputs.host }}" >> ~/.ssh/known_hosts
 
       - name: Deploy over SSH
         env:
           SSH_USER: ${{ secrets.SSH_USER }}
-          SSH_HOST: ${{ secrets.SSH_HOST }}
+          SSH_HOST: ${{ steps.vars.outputs.host }}
           REPO: ${{ github.repository }}
           BRANCH: ${{ github.ref_name }}
           GHCR_USER: ${{ secrets.GHCR_USER }}
           GHCR_TOKEN: ${{ secrets.GHCR_TOKEN }}
-          IMAGE: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
-          IMAGE_TAG: ${{ needs.build.outputs.image_tag }}
-          ENV_FILE: ${{ vars.ENV_FILE || '.env.enc' }}
-          DEPLOY_PATH: ${{ vars.DEPLOY_PATH || '/opt/underlay' }}
+          IMAGE_TAG: ${{ steps.vars.outputs.image_tag }}
+          ENV_FILE: ${{ steps.vars.outputs.env_file }}
+          STACK_NAME: ${{ steps.vars.outputs.stack_name }}
         run: |
           ssh "${SSH_USER}@${SSH_HOST}" \
-            "env GHCR_USER='${GHCR_USER}' GHCR_TOKEN='${GHCR_TOKEN}' IMAGE='${IMAGE}' IMAGE_TAG='${IMAGE_TAG}' ENV_FILE='${ENV_FILE}' bash -s -- '${REPO}' '${BRANCH}' '${DEPLOY_PATH}'" <<'EOS'
+            "env GHCR_USER='${GHCR_USER}' GHCR_TOKEN='${GHCR_TOKEN}' IMAGE_TAG='${IMAGE_TAG}' ENV_FILE='${ENV_FILE}' STACK_NAME='${STACK_NAME}' bash -s -- '${REPO}' '${BRANCH}'" <<'EOS'
           set -euo pipefail
 
           REPO="${1:?missing repo}"
           BRANCH="${2:-main}"
-          APP_DIR="${3:-/opt/underlay}"
 
-          : "${IMAGE:?missing IMAGE}"
           : "${IMAGE_TAG:?missing IMAGE_TAG}"
           : "${GHCR_USER:?missing GHCR_USER}"
           : "${GHCR_TOKEN:?missing GHCR_TOKEN}"
+          : "${STACK_NAME:?missing STACK_NAME}"
 
+          REPO_NAME="${REPO##*/}"
+          APP_DIR="/srv/${REPO_NAME}"
           REPO_SSH="git@github.com:${REPO}.git"
 
           ssh-keyscan -H github.com >> ~/.ssh/known_hosts 2>/dev/null
@@ -105,38 +139,54 @@ jobs:
           fi
 
           cd "${APP_DIR}"
-          git fetch --prune origin
-          git checkout "${BRANCH}"
-          git pull origin "${BRANCH}"
+          git fetch --prune --tags origin
+          git checkout --detach "${IMAGE_TAG}"
 
           : "${ENV_FILE:?missing ENV_FILE}"
+          umask 077
           sops -d --input-type dotenv --output-type dotenv "$ENV_FILE" > .env
 
-          echo "$GHCR_TOKEN" | docker login ghcr.io -u "$GHCR_USER" --password-stdin
+          # Init swarm if not already active
+          if ! sudo docker info --format '{{.Swarm.LocalNodeState}}' | grep -qx active; then
+            sudo docker swarm init
+          fi
+
+          echo "$GHCR_TOKEN" | sudo docker login ghcr.io -u "$GHCR_USER" --password-stdin
+
+          sudo docker pull "ghcr.io/${REPO}:${IMAGE_TAG}"
 
-          export IMAGE IMAGE_TAG
-          docker compose pull
-          docker compose up -d --remove-orphans
+          # Deploy/update stack
+          sudo env IMAGE="ghcr.io/${REPO}" IMAGE_TAG="$IMAGE_TAG" \
+            docker stack deploy -c docker-compose.yml \
+            --with-registry-auth --resolve-image always --prune "${STACK_NAME}"
 
-          wait_healthy() {
-            local timeout="${1:-120}"
+          sudo docker stack services "${STACK_NAME}"
+
+          # Wait for rollout
+          wait_rollout() {
+            local svc="$1" timeout="${2:-300}"
             local end=$((SECONDS + timeout))
             while (( SECONDS < end )); do
-              if ! docker compose ps | grep -qiE 'starting|unhealthy|restarting'; then
-                echo "All services running"
-                docker compose ps
+              local desired running state
+              desired="$(sudo docker service inspect "$svc" --format '{{.Spec.Mode.Replicated.Replicas}}' 2>/dev/null || echo "")"
+              running="$(sudo docker service ps "$svc" --filter desired-state=running --format '{{.CurrentState}}' 2>/dev/null | grep -c '^Running' || true)"
+              state="$(sudo docker service inspect "$svc" --format '{{if .UpdateStatus}}{{.UpdateStatus.State}}{{end}}' 2>/dev/null || echo "")"
+              echo "  $svc: desired=$desired running=$running state=$state"
+              if [[ -n "$desired" && "$running" == "$desired" ]] && { [[ -z "$state" ]] || [[ "$state" == "completed" ]]; }; then
+                echo "  $svc rollout complete"
                 return 0
               fi
-              echo "Waiting for services..."
               sleep 5
             done
-            echo "Rollout timeout"
-            docker compose ps
+            echo "Rollout timeout for $svc"
             return 1
           }
-          wait_healthy 120
 
-          docker image prune -a --filter "until=72h" -f
+          wait_rollout "${STACK_NAME}_app" 300
+          wait_rollout "${STACK_NAME}_cron" 120
+
+          # Cleanup old images
+          sudo docker image prune -a --filter "until=72h" -f
 
-          echo "Deployed to $(hostname)"
+          echo "Deployed ${STACK_NAME} @ ${IMAGE_TAG} to $(hostname)"
           EOS

Caddyfile

@@ -0,0 +1,39 @@
+# Host-level Caddy — manages TLS for all domains.
+# Deploy to /etc/caddy/Caddyfile on the server.
+# Reload with: systemctl reload caddy
+
+www.underlay.org {
+    # API routes → Fastify (prod)
+    handle /api/* {
+        reverse_proxy localhost:3001
+    }
+    handle /assets/* {
+        reverse_proxy localhost:3001
+    }
+    handle /uploads/* {
+        reverse_proxy localhost:3001
+    }
+
+    # Everything else → Astro SSR (prod)
+    handle {
+        reverse_proxy localhost:4322
+    }
+}
+
+dev.underlay.org {
+    # API routes → Fastify (dev)
+    handle /api/* {
+        reverse_proxy localhost:3000
+    }
+    handle /assets/* {
+        reverse_proxy localhost:3000
+    }
+    handle /uploads/* {
+        reverse_proxy localhost:3000
+    }
+
+    # Everything else → Astro SSR (dev)
+    handle {
+        reverse_proxy localhost:4321
+    }
+}

docker-compose.dev.yml

@@ -1,7 +1,8 @@
 # Development compose — source-mounted for fast reload.
 # Start with: ./dev.sh
+# Access directly at localhost:4321 (Astro) and localhost:3000 (API).
 
-name: underlay
+name: underlay-dev
 
 services:
   postgres:
@@ -10,15 +11,29 @@ services:
       POSTGRES_USER: underlay
       POSTGRES_PASSWORD: underlay
       POSTGRES_DB: underlay
+    command: >
+      -c shared_buffers=256MB
+      -c effective_cache_size=512MB
+      -c work_mem=8MB
+      -c maintenance_work_mem=64MB
+      -c max_connections=50
     ports:
-      - "5432:5432"
+      - "5433:5432"
     volumes:
-      - pgdata:/var/lib/postgresql/data
+      - pgdata-dev:/var/lib/postgresql/data
+    networks:
+      - dev
+      - dbaccess-dev
     healthcheck:
-      test: [ "CMD-SHELL", "pg_isready -U underlay" ]
+      test: ["CMD-SHELL", "pg_isready -U underlay"]
       interval: 5s
       timeout: 3s
       retries: 5
+    deploy:
+      resources:
+        limits:
+          memory: 1g
+          cpus: "1.0"
 
   minio:
     image: minio/minio:latest
@@ -30,13 +45,17 @@ services:
       - "9000:9000"
       - "9001:9001"
     volumes:
-      - miniodata:/data
+      - miniodata-dev:/data
+    networks:
+      - dev
 
   createbucket:
     image: minio/mc:latest
     depends_on:
       minio:
         condition: service_started
+    networks:
+      - dev
     entrypoint: >
       /bin/sh -c "
       sleep 2;
@@ -66,14 +85,23 @@ services:
       - ./tsconfig.json:/app/tsconfig.json
       - ./drizzle.config.ts:/app/drizzle.config.ts
       - ./tools:/app/tools
-      # Keep container's own node_modules
       - /app/node_modules
-    ports:
-      - "${APP_PORT:-4321}:4321"
-      - "${API_PORT:-3000}:3000"
+    networks:
+      - dev
+    deploy:
+      resources:
+        limits:
+          memory: 512m
+          cpus: "1.0"
     command: ["sh", "-c", "npm run db:migrate && npm run db:seed && npm run dev:server"]
     restart: unless-stopped
 
+networks:
+  dev:
+    driver: bridge
+  dbaccess-dev:
+    driver: bridge
+
 volumes:
-  pgdata:
-  miniodata:
+  pgdata-dev:
+  miniodata-dev: